7 ms·

Cypherpunk Desert Bus: My Role in the 2016 Zcash Trusted Setup Ceremony

126 points by monort 9y ago

petertodd 9y ago
When reading this, pay attention to section 1.2: "Until the software and deterministic builds are audited, the entire ceremony is a bunch of crypto hocus pocus that means nothing." I'm 100% serious, and even a year later this still hasn't been done properly.
- the_stc 9y ago
  2^80 is not very weak. That's the level of brute forcing a SHA-1 collision. It's low for a new system, but not very weak. I agree with your 20%/10% comments, but I do not know why you call ZCash an investment. Zcash should discourage people from investing, like Monero does. Be a privacy coin, do not try to get in on the moon and lambo hypetrains if you want to be taken seriously. There is no good justification for 20% right now. ZEC market cap is half a billion today. Do they really need that extra 50 mln now versus over time? Feels greedy. But with so much taken by them that way, does that not reduce their desire to get a backdoor? At any rate, all of this ceremony and your measures seem, as you say, hocus pocus if you're not building from known source! Forget hardware attacks! How can they not have the basics of a secure toolchain?!? Did some participants at least publish the source they used and hashes of the toolchain and environment? At my startup (details in profile) we will end up depending on crypto (among other things) to stay out of prison. Monero is hard to use, privacy wise - EABE and EWE attacks are our concerns. At least with ZCash the model is fairly easy to understand with shielded transactions. Much easier than figuring out ringsize and traceability there. But the Monero community seems better with no 20% take, no central company, none of this trusted nonsense. And no odd comments by both founders that require lots of mental gymnastics to make sense of. Not that any of this should matter. ZCash should be trusted on its own merits regardless of the inventors. Monero has anonymous inventors which could be the NSA for all we know. Alas I am in no position to analyze ZCash math vs RingCT but my feeling is the latter is more understandable and thus might be more secure even if it has much weaker safety promises.
  - ewillbefull 9y ago
    > 2^80 is not very weak. That's the level of brute forcing a SHA-1 collision. It's low for a new system, but not very weak. Note that the 2^80 figure from Peter's blog post is really unsubstantiated. There's another curve in libsnark (which we don't use) that has 80-bits of security. I suspect what happened is whoever Peter was consulting with just repeated this number to him. We've spoken to many cryptographers who are experts on these curves, and none of them think that figure is reasonable. I actually don't believe there are _any_ cryptographers that have publicly made such a claim about the security. 2^96 was the original conservative estimate when the NFS attack was discovered, but subsequent analysis showed concrete security closer to 2^110 (and that's ignoring the unrealistic memory costs of the specific attack.) > How can they not have the basics of a secure toolchain?!? We provided participants with a reproducibly built and stripped down version of Alpine Linux, employed grsec, wrote all of our crypto software in pure Rust, etc. All of our software is reproducibly built, hashed and signed. There is nothing (software-wise) that cannot be caught in post-hoc review. All of it is open-source: https://github.com/zcash/mpc https://github.com/zcash/mpc Several academic papers regarding our protocol have been published since then. We wrote a full security proof of the crypto. We hired NCC group to audit the ceremony as well: https://z.cash/blog/ceremony-audit-results.html https://z.cash/blog/ceremony-audit-results.html More auditing can always be done but this is a continuing process. The primary goal is to make it difficult for someone to undetectably compromise the ceremony.
    - the_stc 9y ago
      What is Peter referring to when he says there's no reproducible builds?
      - petertodd 9y ago
        I didn't say that. What I said was those builds hadn't been properly audited; just being reproducible isn't enough unless people actually reproduce them, and additionally, audit the dependencies that go into those builds.
    - petertodd 9y ago
- alexnewman 9y ago
  Totally agree. hopefully this time the laptops weren't all owned by amt
shrikant 9y ago
Related Radiolab episode: http://www.radiolab.org/story/ceremony/ http://www.radiolab.org/story/ceremony/
deleted 9y ago
[deleted]
jnagro 9y ago
he uses a BLU phone in a few of the pictures, they had factory installed malware if i remember correctly?
- petertodd 9y ago
  Yup. Also the model of Thinkpad I used was vulnerable to the Intel management engine backdoor.
- chrononaut 9y ago
  Multiple[0][1] forms of possible malware, or at least poorly constructed update platforms. [0] https://www.kryptowire.com/adups_security_analysis.html https://www.kryptowire.com/adups_security_analysis.html [1] https://www.bitsighttech.com/blog/ragentek-android-ota-update-mechanism-vulnerable-to-mitm-attack https://www.bitsighttech.com/blog/ragentek-android-ota-updat...
runeks 9y ago
> The secret key (“cryptographic toxic waste”) generated during this phase can be used to steal money - currently in the form of creating counterfeit coins, stealing from everyone collectively. > As one of those participants, here’s my account of what I did to ensure that secret was destroyed. Regardless of what he did or did not do to destroy this secret, doesn’t this make ZCash inherently non-trustless? If we trust that these people are honest, why not just have them sign messages with their keys to resolve double-spends, rather than build an elaborate system on top of this trust? In other words, the ZCash crypto might be trustless itself, but if it’s employed on top of a base that requires trust, what’s the point in the first place? The weakest link is at the base. “If you just trust me, I have some really cool trustless crypto to show you”
- petertodd 9y ago
  The trust involved in the Zcash trusted setup is a significantly better type of trust than what you're suggesting, because you only have to trust the people involved once. Signing messages is an ongoing trust, which is far more vulnerable to attack.
  - runeks 9y ago
    > The trust involved in the Zcash trusted setup is a significantly better type of trust than what you're suggesting, because you only have to trust the people involved once. I disagree. Since there’s no way for you to prove that you have actually destroyed the secret in question, there’s no way for me to know where that key is now and, hence, how long I need to trust you. “Only having to trust the people involved once” presupposes that I trust that they have destroyed the key properly, otherwise the key might still be out there, and the trust would be ongoing in this case as well.
    - Doxin 9y ago
      Worst case the two scenarios equate to the same thing. Namely there's one or more people you need to trust indefinitely. Best case however is where they differ a lot. Best case for this method is trusting someone once. Best case for the other method is still trusting one or more people indefinitely.
unabridged 9y ago
Why not up the number of participants to 1000? Or 1M?
- ewillbefull 9y ago
  The protocol could not scale to a large number of participants at the time. Just with six participants it took an entire weekend to perform.
  - unabridged 9y ago
    I've been looking for some kind of discussion of the scalability of the trusted setup, but I cannot find it. Do you have a link?
    - ewillbefull 9y ago
      https://eprint.iacr.org/2017/602 https://eprint.iacr.org/2017/602 The protocol scales linearly with respect to the number of participants, but as you can tell, each participant needs to do a lot of time-consuming computations. Each participant needs to maintain custody of the hardware during the process of the ceremony, and then destroy the hardware afterward. If it was your turn, you'd do some stuff for an hour, and then it's the next person's turn in a round-robin circle. You had to wait maybe ~8 hours before it was your turn again. The protocol involved three rounds of this. Nobody can abort (players commit to their moves in advance to defend against adaptive attacks) and so there needs to be a time when all N participants are available for the entire duration of the ceremony. This makes it very sensitive to scheduling problems. If you want to do your own MPC, you also need to perform very expensive fast-fourier transforms in between round 1 and 2. In our ceremony that required a very beefy 128-core server and it still took over an hour. I actually just found a log file from the ceremony's coordinator server (not a privileged server, just handles messages and archives them) which shows the timings of everything, which is kind of fun: https://gist.github.com/ebfull/fde1e167ba35ca67e086ca458eabcf25 https://gist.github.com/ebfull/fde1e167ba35ca67e086ca458eabc...
j_s 9y ago
The Security Behind the Birth of Zcash | https://news.ycombinator.com/item?id=14782232 https://news.ycombinator.com/item?id=14782232 (Jul 2017, 49 comments)
mmel 9y ago
Why does ZCash get shilled so much on HN compared to every other altcoin?
- mhluongo 9y ago
  Because the math is freaking cool? :)
  - ringaroundthetx 9y ago
    thats what all the drones at Zcash say. It is either that they like the math, or they find validation from stacking the team with renowned cryptographers. there is almost no intersection of people interested in zcash and people that actually want to use cryptocurrency or keep zcash in their portfolio who have done any analysis of how this is not something to hold for long.
    - cooldude2282 9y ago
      I am very interested in the math, but I kind of agree with you, I am not invested in zcash. If they didn't have first mover advantage they would not be doing as well as they are. The best implementation using this mathematics is definitely yet to come, I would not be surprised if they weren't surpassed by someone else using similar tech in the very near future.
- Casseres 9y ago
  The top comment on the Zcash post from yesterday (!) has a good theory on why Zcash is posted about so often: "Is it just me or are more and more stories which look like fluff pieces for ZCash coming up on the HN frontpage? If they were a startup, I'd guess they were prepping for an IPO/acquisition. Most of them have titles with rhetorical questions, and come across as marketing pieces more than anything else. Really weird." - https://news.ycombinator.com/item?id=15430668 https://news.ycombinator.com/item?id=15430668
failrate 9y ago
I enjoyed reading this. It felt like a single perspective in a pulp security thriller. It would be interesting for someone to write fiction from the perspective of a potential attacker.
youdontknowtho 9y ago
i really enjoyed this story. i havent really followed zcash, but im going to look into it now. cheers.
just_one_time_ 9y ago
Please God, I met Peter Todd and he was one of the rudest most self riotous people I can imagine, just a jerk.

126 points by monort 9y ago

When reading this, pay attention to section 1.2: "Until the software and deterministic builds are audited, the entire ceremony is a bunch of crypto hocus pocus that means nothing." I'm 100% serious, and even a year later this still hasn't been done properly.

the_stc 9y ago
2^80 is not very weak. That's the level of brute forcing a SHA-1 collision. It's low for a new system, but not very weak. I agree with your 20%/10% comments, but I do not know why you call ZCash an investment. Zcash should discourage people from investing, like Monero does. Be a privacy coin, do not try to get in on the moon and lambo hypetrains if you want to be taken seriously. There is no good justification for 20% right now. ZEC market cap is half a billion today. Do they really need that extra 50 mln now versus over time? Feels greedy. But with so much taken by them that way, does that not reduce their desire to get a backdoor? At any rate, all of this ceremony and your measures seem, as you say, hocus pocus if you're not building from known source! Forget hardware attacks! How can they not have the basics of a secure toolchain?!? Did some participants at least publish the source they used and hashes of the toolchain and environment? At my startup (details in profile) we will end up depending on crypto (among other things) to stay out of prison. Monero is hard to use, privacy wise - EABE and EWE attacks are our concerns. At least with ZCash the model is fairly easy to understand with shielded transactions. Much easier than figuring out ringsize and traceability there. But the Monero community seems better with no 20% take, no central company, none of this trusted nonsense. And no odd comments by both founders that require lots of mental gymnastics to make sense of. Not that any of this should matter. ZCash should be trusted on its own merits regardless of the inventors. Monero has anonymous inventors which could be the NSA for all we know. Alas I am in no position to analyze ZCash math vs RingCT but my feeling is the latter is more understandable and thus might be more secure even if it has much weaker safety promises.
- ewillbefull 9y ago
  > 2^80 is not very weak. That's the level of brute forcing a SHA-1 collision. It's low for a new system, but not very weak. Note that the 2^80 figure from Peter's blog post is really unsubstantiated. There's another curve in libsnark (which we don't use) that has 80-bits of security. I suspect what happened is whoever Peter was consulting with just repeated this number to him. We've spoken to many cryptographers who are experts on these curves, and none of them think that figure is reasonable. I actually don't believe there are _any_ cryptographers that have publicly made such a claim about the security. 2^96 was the original conservative estimate when the NFS attack was discovered, but subsequent analysis showed concrete security closer to 2^110 (and that's ignoring the unrealistic memory costs of the specific attack.) > How can they not have the basics of a secure toolchain?!? We provided participants with a reproducibly built and stripped down version of Alpine Linux, employed grsec, wrote all of our crypto software in pure Rust, etc. All of our software is reproducibly built, hashed and signed. There is nothing (software-wise) that cannot be caught in post-hoc review. All of it is open-source: https://github.com/zcash/mpc https://github.com/zcash/mpc Several academic papers regarding our protocol have been published since then. We wrote a full security proof of the crypto. We hired NCC group to audit the ceremony as well: https://z.cash/blog/ceremony-audit-results.html https://z.cash/blog/ceremony-audit-results.html More auditing can always be done but this is a continuing process. The primary goal is to make it difficult for someone to undetectably compromise the ceremony.
  - the_stc 9y ago
    What is Peter referring to when he says there's no reproducible builds?
    - petertodd 9y ago
      I didn't say that. What I said was those builds hadn't been properly audited; just being reproducible isn't enough unless people actually reproduce them, and additionally, audit the dependencies that go into those builds.
  - petertodd 9y ago
alexnewman 9y ago
Totally agree. hopefully this time the laptops weren't all owned by amt

shrikant 9y ago

Related Radiolab episode: http://www.radiolab.org/story/ceremony/ http://www.radiolab.org/story/ceremony/

deleted 9y ago

[deleted]

jnagro 9y ago

he uses a BLU phone in a few of the pictures, they had factory installed malware if i remember correctly?

petertodd 9y ago
Yup. Also the model of Thinkpad I used was vulnerable to the Intel management engine backdoor.
chrononaut 9y ago
Multiple[0][1] forms of possible malware, or at least poorly constructed update platforms. [0] https://www.kryptowire.com/adups_security_analysis.html https://www.kryptowire.com/adups_security_analysis.html [1] https://www.bitsighttech.com/blog/ragentek-android-ota-update-mechanism-vulnerable-to-mitm-attack https://www.bitsighttech.com/blog/ragentek-android-ota-updat...

runeks 9y ago

> The secret key (“cryptographic toxic waste”) generated during this phase can be used to steal money - currently in the form of creating counterfeit coins, stealing from everyone collectively. > As one of those participants, here’s my account of what I did to ensure that secret was destroyed. Regardless of what he did or did not do to destroy this secret, doesn’t this make ZCash inherently non-trustless? If we trust that these people are honest, why not just have them sign messages with their keys to resolve double-spends, rather than build an elaborate system on top of this trust? In other words, the ZCash crypto might be trustless itself, but if it’s employed on top of a base that requires trust, what’s the point in the first place? The weakest link is at the base. “If you just trust me, I have some really cool trustless crypto to show you”

petertodd 9y ago
The trust involved in the Zcash trusted setup is a significantly better type of trust than what you're suggesting, because you only have to trust the people involved once. Signing messages is an ongoing trust, which is far more vulnerable to attack.
- runeks 9y ago
  > The trust involved in the Zcash trusted setup is a significantly better type of trust than what you're suggesting, because you only have to trust the people involved once. I disagree. Since there’s no way for you to prove that you have actually destroyed the secret in question, there’s no way for me to know where that key is now and, hence, how long I need to trust you. “Only having to trust the people involved once” presupposes that I trust that they have destroyed the key properly, otherwise the key might still be out there, and the trust would be ongoing in this case as well.
  - Doxin 9y ago
    Worst case the two scenarios equate to the same thing. Namely there's one or more people you need to trust indefinitely. Best case however is where they differ a lot. Best case for this method is trusting someone once. Best case for the other method is still trusting one or more people indefinitely.

unabridged 9y ago

Why not up the number of participants to 1000? Or 1M?

ewillbefull 9y ago
The protocol could not scale to a large number of participants at the time. Just with six participants it took an entire weekend to perform.
- unabridged 9y ago
  I've been looking for some kind of discussion of the scalability of the trusted setup, but I cannot find it. Do you have a link?
  - ewillbefull 9y ago
    https://eprint.iacr.org/2017/602 https://eprint.iacr.org/2017/602 The protocol scales linearly with respect to the number of participants, but as you can tell, each participant needs to do a lot of time-consuming computations. Each participant needs to maintain custody of the hardware during the process of the ceremony, and then destroy the hardware afterward. If it was your turn, you'd do some stuff for an hour, and then it's the next person's turn in a round-robin circle. You had to wait maybe ~8 hours before it was your turn again. The protocol involved three rounds of this. Nobody can abort (players commit to their moves in advance to defend against adaptive attacks) and so there needs to be a time when all N participants are available for the entire duration of the ceremony. This makes it very sensitive to scheduling problems. If you want to do your own MPC, you also need to perform very expensive fast-fourier transforms in between round 1 and 2. In our ceremony that required a very beefy 128-core server and it still took over an hour. I actually just found a log file from the ceremony's coordinator server (not a privileged server, just handles messages and archives them) which shows the timings of everything, which is kind of fun: https://gist.github.com/ebfull/fde1e167ba35ca67e086ca458eabcf25 https://gist.github.com/ebfull/fde1e167ba35ca67e086ca458eabc...

j_s 9y ago

The Security Behind the Birth of Zcash | https://news.ycombinator.com/item?id=14782232 https://news.ycombinator.com/item?id=14782232 (Jul 2017, 49 comments)

mmel 9y ago

Why does ZCash get shilled so much on HN compared to every other altcoin?

mhluongo 9y ago
Because the math is freaking cool? :)
- ringaroundthetx 9y ago
  thats what all the drones at Zcash say. It is either that they like the math, or they find validation from stacking the team with renowned cryptographers. there is almost no intersection of people interested in zcash and people that actually want to use cryptocurrency or keep zcash in their portfolio who have done any analysis of how this is not something to hold for long.
  - cooldude2282 9y ago
    I am very interested in the math, but I kind of agree with you, I am not invested in zcash. If they didn't have first mover advantage they would not be doing as well as they are. The best implementation using this mathematics is definitely yet to come, I would not be surprised if they weren't surpassed by someone else using similar tech in the very near future.
Casseres 9y ago
The top comment on the Zcash post from yesterday (!) has a good theory on why Zcash is posted about so often: "Is it just me or are more and more stories which look like fluff pieces for ZCash coming up on the HN frontpage? If they were a startup, I'd guess they were prepping for an IPO/acquisition. Most of them have titles with rhetorical questions, and come across as marketing pieces more than anything else. Really weird." - https://news.ycombinator.com/item?id=15430668 https://news.ycombinator.com/item?id=15430668

failrate 9y ago

I enjoyed reading this. It felt like a single perspective in a pulp security thriller. It would be interesting for someone to write fiction from the perspective of a potential attacker.

youdontknowtho 9y ago

i really enjoyed this story. i havent really followed zcash, but im going to look into it now. cheers.

just_one_time_ 9y ago

Please God, I met Peter Todd and he was one of the rudest most self riotous people I can imagine, just a jerk.